Think what I did before was put the NAS on the network service filter, deny list with all ports but the time port, which I think is UDP 123?
P.s for now I've just blocked all WAN access, was easier in the app, that made a rule in Parental Controls time scheduling.
What port is the NTP?